Under the UK GDPR and EU GDPR, we process your personal data on the following lawful bases:

• Contract — to provide the Carbon Sky Index service to you, including account creation, authentication, subscription management, and delivery of features such as watchlists and alerts.
• Legitimate interests — to improve our platform, understand how the service is used, prevent fraud and abuse, and communicate with you about service updates. We have assessed that these interests do not override your fundamental rights.
• Consent — for optional communications such as marketing emails and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Legal obligation — where we are required to process data to comply with applicable laws, including tax, accounting, and law enforcement requests.

Carbon Sky Index is based in the United Kingdom. Some of our service providers (including AWS and Google Cloud Platform) may process data in the United States or other countries outside the UK and EEA.

Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards as required by UK GDPR and EU GDPR, including the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses, depending on the destination.

You may request a copy of the relevant safeguards by contacting privacy@carbonskyindex.com.

We retain your personal data only for as long as necessary to provide the service and meet our legal obligations:

• Account data — retained for the lifetime of your account, and deleted within 90 days of account closure unless we are required to retain it longer for legal, tax, or accounting reasons.
• Usage and analytics data — retained in identifiable form for up to 24 months, after which it is anonymised or deleted.
• Billing and tax records — retained for 7 years to comply with UK accounting and tax law.
• Marketing communications data — retained until you withdraw consent or unsubscribe.

If you would like more detail on retention for a specific category of data, contact privacy@carbonskyindex.com.

Under the UK GDPR and EU GDPR, you have the following rights in relation to your personal data:

• Right to Access — Request a copy of all data we hold about you.
• Right to Rectification — Update or correct any inaccurate information.
• Right to Erasure — Request deletion of your personal data, subject to legal retention requirements.
• Right to Object — Object to processing of your data based on legitimate interests, including for direct marketing.
• Right to Restrict Processing — Ask us to limit how we use your data while a request is being resolved.
• Right to Data Portability — Receive your data in a structured, commonly used, machine-readable format, or have it transmitted to another controller where technically feasible.
• Right to Withdraw Consent — Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact privacy@carbonskyindex.com. We will respond within one month, as required by UK GDPR. There is no fee for exercising your rights, except where requests are manifestly unfounded or excessive.

Magic Lagoon Limited is the data controller for the personal data described in this Privacy Policy.

If you have a complaint about how we handle your personal data, we ask that you first contact us so we have the opportunity to resolve it.

You also have the right to lodge a complaint with a data protection supervisory authority:

• United Kingdom — Information Commissioner's Office (ICO), https://ico.org.uk
• European Union — the supervisory authority in your country of residence, work, or where the alleged infringement took place.